Vladimir Gusarov·Sep 29All packages up to date, still vulnerable: fixing transitive NuGet CVEs in .NETSecurity scans flag a NuGet package you never added, and updating won't clear it. Here's how to find the cause and pin it once.
InJavarevisitedbyChaskarshailesh·Aug 28One Pipeline, Three Roles: Operationalizing GHAS Secret ScanningPart 2 of 3 — Making dev, SecOps, and the build pipeline work as a single DevSecOps unit
InJavarevisitedbyChaskarshailesh·Aug 25From Detection to Remediation: GHAS Secret Scanning for DevSecOpsPart 1 of 3 — How secrets leak, how GHAS finds them, and the six-step fix prompt
InJavarevisitedbyChaskarshailesh·Aug 25Cleaning Up GitHub Commit History: A DevSecOps Engineer’s GuidePart 3 of 3 — Rewriting history safely, and what rewriting history can’t fix
InstaSLA·Aug 20GitHub Advanced Security ROI: Why Scanning Without SLAs Is a Waste of MoneyBack to blogThe Illusion of Security: Identification vs. RemediationWhy Scanning Fails in a Vacuum: The Alert Fatigue EpidemicThe Missing…
